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We demonstrate extraction of randomness from spontaneous-emission events less than 36 ns in the 
past, giving output bits with excess predictability below 10“^ and strong metrological randomness 
assurances. This randomness generation strategy satisfies the stringent requirements for unpre¬ 
dictable basis choices in current “loophole-free Bell tests” of local realism [Hensen et ah. Nature 
(London) 526, 682 (2015); Giustina et ah, Phys. Rev. Lett. 115, 250401 (2015); Shalm et ah, Phys. 

Rev. Lett. 115, 250402 (2015)]. 
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Quantum nonlocality [T] is one of the most striking 
predictions to emerge from quantum theory. Beyond 
their fundamental interest, loophole-free Bell tests en¬ 
able powerful “device independent” information proto¬ 
cols, guaranteed by the impossibility of faster-than-light 
communication [2]. Bell tests and device-independent 
protocols employ spacelike separation of measurements 
to guarantee the nonlocality of correlations [3HH] and the 
monogamy of correlations under the no-signaling prin¬ 
ciple [SHIl]- To be secure, they must close two space- 
time loopholes: no basis choice may influence a distant 
particle (locality loophole), and the entanglement gener¬ 
ation must not influence the basis choices (freedom-of- 
choice loophole). Current efforts [6l [71 [T2UT4] to simul¬ 
taneously close the detection mail], locality [3], and 
freedom-of-choice (FoC) [5l [8] loopholes require random 
number generators (RNGs) with an unprecedented com¬ 
bination of speed, unpredictability, and confidence US¬ 
UI]. 

Here we combine ultrafast RNG by accelerated laser 
phase diffusion [T8H2Q] with real-time randomness ex¬ 
traction and metrological randomness assurances [21] to 
produce a RNGs suitable for loophole-free Bell tests. Be¬ 
cause the laser phase diffusion is driven by effects, includ¬ 
ing spontaneous emission, that are unpredictable both in 
quantum theory and in an important class of stochas¬ 
tic hidden variable theories, the source can be used to 
address the “freedom-of-choice” loophole [22|. Using a 
detailed and validated model of the signal generation pro¬ 
cess, we show the effectiveness of parity-bit randomness 
extraction of this source. Under paranoid assumptions, 
we infer excess predictability below 10“^ at 6cr statistical 
confidence for output based on phase-diffusion events less 
than 36 ns old. A statistical analysis based on 2.3 Tbits of 
random data supports the metrological assessment of ex¬ 
treme unpredictability. The results enable definitive non¬ 
locality experiments and secure communications without 
the need for trusted devices [SllIIlESlEl]. 

As shown in Fig. the locality and freedom-of-choice 
loopholes can be closed by spacelike separation of the 


random events that determine the basis choice from the 
distant detection and from the production of the pairs of 
particles, respectively m- This requires generation of 
randomness in a time window shorter than the light time 
between the detectors. Closing the “detection loophole” 
requires high efficiency and motivates protocols very sen¬ 
sitive to predictability of the basis choices. Both experi¬ 
ments employing 100% efficient “event-ready” detection 
[25] and those employing high-efficiency photodetection 
EiEii, are expected to require excess predictabilities e 
below a few times 10“^ [22]. 

Time and/or frequency metrology, e.g. jitter measure¬ 
ments against stabilized oscillators, are routinely used 
to determine timing with sub-ns precision and accu¬ 
racy, allowing reliable identification of spacelike sepa¬ 
rated events. Achieving similar assurances for unpre¬ 
dictability poses a distinct challenge. For fundamental 
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FIG. 1. Space-time diagram for the production of random 
numbers in a loophole-free Bell scenario. As shown, up to k 
raw bits can be generated in a time window that is spacelike 
separated from both (i) the pair generation and (ii) the distant 
measurement. Laser pulses (^^) with random phases (fi are 
converted into raw random bits di and extracted bits Xi by a 
running XOR (0) calculation. 
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reasons, no test on the output of a RNG can demon¬ 
strate randomness, and statistical characterization of the 
RNG process becomes the critical task. Here we develop 
statistical metrology for a short-delay RNG, in analogy 
to earlier work with high-throughput RNGs [ElEIllll. 
The excess predictability e is exponentially reduced by 
randomness extraction (RE) [29]: in real time, we com¬ 
pute the parity of several raw bits to produce one very 
unpredictable extracted bit for the setting choice. 

The RNG and its behavior are illustrated in Fig.|^ A 
single-mode laser diode (LD) is strongly current modu¬ 
lated, going above threshold for about 2 ns of every 5 
ns cycle, to produce a train of optical pulses with very 
similar waveforms, as seen in Fig. (b). In the time 
below threshold strong phase diffusion randomizes the 
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FIG. 2. Random number generation for loophole-free Bell 
tests, (a) Experimental schematic. Laser pulses with random 
phases (j)i from a distributed feedback laser diode (DFB LD) 
are converted to random powers pi by an UMZI and detected 
with a linear photoreceiver (PIN PD) to give analog voltages 
Vi . These are one-bit digitized with a comparator and D-type 
flip-flop to give raw bits di, and summed modulo 2 with an 
XOR gate to give extracted bits xi. The output value 
includes the parity of k raw bits, to due to pulses 

spacelike separated from the distant measurement and from 
the entanglement production, (b), (c) “Persistence mode” 
visualization of v{t) statistics. Warmer colors show greater 
frequency; teal histogram on the left axis describes the volt¬ 
ages sampled inside the time window indicated in gray, (b) 
Noninterfering pulses obtained by blocking the long interfer¬ 
ometer path; (c) interfering pulses, (d) Two-state machine 
describing the randomness extraction. 


optical phase within the laser [301 SB, and, thus, the rel¬ 
ative phase (j) from one pulse to the next. At the time a 
pulse leaves the laser, it is already a macroscopic (^ mW) 
signal, with a phase that has been fully randomized by 
the microscopic process of spontaneous emission. An un¬ 
balanced Mach-Zehnder interferometer (UMZI) converts 
the train of phase-random pulses into amplitude-random 
pulses; see Fig. K c). These are detected with a fast pho¬ 
todiode, giving a voltage signal v{t). A fast comparator 
and a D-type flip-flop digitize (with one-bit resolution) 
the signal at times U to give, at 200 Mbps, raw digital 
values di = 0{v{ti) — 'i;ref(U )])5 where 0 is the Heaviside 
step function and v^ei is the comparator reference level. 
To correct for drifts in laser power, the reference level is 
set by feedback from the raw digital values via an inte¬ 
grator with a 1 ms time constant. We observe a raw-bit 
average of (d) = |[1 + 6.9(1) x 10“^]. 

An XOR gate and a second flip-flop perform a run¬ 
ning parity calculation, updating the output x as = 
0d^, where 0 indicates addition modulo 2. This de¬ 
scribes a two-state machine, see Fig. [^(d), that changes 
state every time a new raw bit di = 1. Note that x ac¬ 
cumulates the parity of all preceding raw bits, only k of 
which will be spacelike separated from the distant mea¬ 
surement. When a bit Xi^k = 0 0 ... 0 di-^k is 

used for a basis setting, Xi contributes no spacelike sepa¬ 
rated randomness, and the predictability of Xij^k will be 
determined by 0 ... 0 di-^k = Writing the pre¬ 
dictability of d^, i.e. the probability of the more likely 
value, as V{di) = ^(1 0 e^), where > 0 is the instanta¬ 
neous excess predictability, we find (see the Supplemental 
Material) that if < e^ax, the predictability of the par¬ 
ity of k bits is bounded as V{Di^k) < ^(1 + ^max)- The 
RE output approaches ideal randomness exponentially in 
k. 

We define the “freshness time” to be the interval be¬ 
tween the earliest spontaneous-emission events required 
for randomizing a bit and the bit’s availability for use. 
The largest phase diffusion occurs at the rising edge of 
the current pulse, when the intracavity photon number 
is at a minimum m- The freshness time for a single bit 
Tf, measured from a rising edge of the electrical modula¬ 
tion signal to availability of the corresponding bit at the 
output port is bounded by 10.01 < Tf < 11.07 ns with 
a p-value < 1.4 x 10“^ (see the Supplementary Mate¬ 
rial). Since we can use {k — 1) extra bits that are still 
spacelike separated, (k — l) additional clock cycles of 5 ns 
each are needed. In total, the freshness time to pro¬ 
duce and propagate k bits from the oldest spacelike sep¬ 
arated spontaneous-emission event to the output port is 
= Tf 0 5 X (k — 1). 

Metrological assurances proceed from the interference 
behavior. The instantaneous power reaching the detector 
is 


P/W =Ps(i)+PL(i) + 2v0(0L0cos</>(t), (1) 






































3 



Input voltage [mV] 


FIG. 3. Histogram (points) of analog signals showing an 
arcsine distribution, and prediction (line) from a Monte Carlo 
simulation of Eq. § using measured rms deviations for all 
noise sources I’s ,,'^’pd ,and I’ref, and a fitted visibility 
V = 0.955. Voltage scale is offset due to ac-coupling. 


where ps and pl are the contributions of the short and 
long paths, respectively. We note that optical visibility 
is guaranteed by the single-spatial-mode fiber interfer¬ 
ometer and the single-longitudinal-mode laser emission. 
Including detection noise and finite bandwidth effects, 
the electronic output is (see the Supplemental Material) 



FIG. 4. Observed frequencies (spot size) of field amplitude 
1^1 and resulting phase dispersion (5(/!)rms over 50 ps, measured 
by heterodyne detection with gain A for continuous currents 
(colors, left to right) 15, 16, 16.5, 17, 17.5, 19 mA. Grey line 
shows (50rms oc \S\~^ scaliug of spontaneous-emission-driven 
phase diffusion. 


0[v{ti) — Vref{ti)] = 0[V(f){ti) -h Vc{ti)], with distribution 


P{d = 1) = Pl 


2 

= — arcsm 

TT 



Vc 

2Av^ 


(3) 


v{t) = vs{t) -h + 'i;pD(^) + ( 2 ) 

where vs and Pp are the short- and long-path contribu¬ 
tions, respectively, ph describes “hangover errors,” i.e. 
delayed contributions from earlier pulses ED, and PpD 
is the detector noise, = 2 Vyd}sW cos 0 is the trusted 
signal from interference, where V is the visibility after 
detection. In Fig. [^, we show the distribution of p, sam¬ 
pled at the moment indicated in Fig. (c), and infer 
V ^ 95% using a Monte Carlo simulation of Eq. (§ (see 
the Supplementary Material). As shown in Fig.|^(c), we 
take a sample < 2 ns after the rising edge occurs, cho¬ 
sen late in the pulse so that relaxation oscillations have 
decayed. The histogram is well modeled by the arcsine 
distribution, which describes the cosine of a uniformly 
distributed phase. 

The trusted randomness of the signal v originates in 
0 , which between pulses strongly diffuses due to sponta¬ 
neous emission, as shown in Fig. (see, also, the Sup¬ 
plemental Material). The observable (j) mod 27r is for all 
practical purposes uniformly distributed on [0, 27r), is un¬ 
predictable based on prior conditions, and is independent 
from one pulse to the next [32] , irrespective of any other 
phase shifts [ 21 ]. 

With the exception of cos0, all contributions to v{t) 
in Eq. and also contain technical noise due to 
prior conditions that are not spacelike separated from the 
distant detection. We define the sum of these untrusted 
contributions Vc = Ps + '^L + '^pd + '^h — '^ref so that di = 


where 2 Ap 0 = 4Vy^FsW is the peak-to-peak range of 
(see the Supplemental Material). The predictability is 
V{d) = max[Pi, 1 — Pi] = ^(1 + e). Bounding the effect 
of Vc on V{d) will determine emax, the upper bound on 

e. 

The contributors to Vc are electronic signals and are 
directly measured with a 4 GHz oscilloscope (Agilent In¬ 
finitum MSO9404A). For example, the variation of vs^ 
the signal in the short path of the interferometer, is mea¬ 
sured by blocking the signal from the long path. The 
measurement gives access to the signal vs + vp^ -\-vo, as 
shown in Fig. (b). Note that the measurement of the 
signal of the short path is not isolated, but superimposed 
to the noises in the photodetector ppp and the scope vq . 
To obtain the noise from vs only, we have to subtract 
the contribution from vpp and vq, both directly mea¬ 
surable. Statistics of the measurable noise contributions, 
always sampled at the same point in the pulse, are given 
in Table SI of the Supplemental Material. 

To combine the noise sources, we consider three levels 
of distrust of the equipment: “ordinary,” “digitizer para¬ 
noid” and “fully paranoid.” In all cases, the noises are 
individually described by the measured statistics of Ta¬ 
ble SI in the Supplemental Material, but their assumed 
correlations vary. In ordinary distrust, we make the phys¬ 
ically reasonable assumption that the noise sources are 
uncorrelated. In digitizer paranoid distrust we assume 
the comparator, the only nonlinear element of the sig¬ 
nal chain, chooses Vref in function of the other noises so 
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as to maximize the predictability. In fully paranoid dis¬ 
trust, we assume that all noise sources are collaborating 
to maximize predictability. These assumptions lead to 
normally-distributed with rms deviations a shown in 
Table [Ij Fluctuations in are, in principle, unbounded 
but rarely exceed a few standard deviations, a situa¬ 
tion that is captured by assigning confidence bounds, in 
this case to V{d) and V{x). For example, considering 
'^c = |('^c)| +b<j as an upper limit, we compute emax using 
Eq. (§. Noise fluctuations will produce a fraction of 
the raw bits with e > emax, where Pqo- ~ 2 x 10“^. The 
excess predictability of the extracted bit exceeds e^^^^ at 
most this often, even assuming maximally correlated raw- 
bit excess predictability. See the Supplemental Material 
for details. Values of emax und Tf for different k and 
distrust levels are shown in Table [I| and in Fig. 

TABLE 1. Noise and predictability for different trust scenar¬ 
ios. All predictabilities are given for a 6a confidence level. 
Times in parentheses indicate freshness time See text 

for details. 


Distrust 

level 


Excess 

Excess 

Noise avc 

predictability 
emax (26 ns) 

predictability 
emax (36 ns) 

Ordinary 

8.6 mV 

2.5 X 10“'^ 

1.3 X 10“’' 

Dig. par. 

11.7 mV 

8.6 X 

8.0 X 10“’' 

Fully par. 

14.5 mV 

2.0 X lO-^ 

2.9 X 10“® 


Although no test of the output can assure random¬ 
ness, tests can, nonetheless, detect failure to be ran¬ 
dom. Because of the low computational capacity of 
physical RNGs, imperfections are expected mostly in 
low-order correlations. The autocorrelation of the ex¬ 
tracted output Tx{k) = {xiXi-^k) — is bounded by 
and, thus, drops off in the same way 
as the excess predictability (see the Supplemental Ma¬ 
terial). As shown in Eig. the measured |ra,(/c)| ap¬ 
proaches zero exponentially in k, and already with k = 4 
reaches \Tx{k)\ < 10“^, the statistical limit with 1 Tbit. 

As detailed in the Supplemental Material, we have ap¬ 
plied statistical tests DIEHARDER [33], NIST SP800-22 
[34] . and TESTUOl ALPHABIT battery [35] to strings of 
extracted data up to 1 Tbit in length. To study a given 
k, we first generate a distilled string Zi = Xik, i.e. {z} is a 
k-fo\d subsampling of {x}. We observe that ALPHABIT, 
designed to test physical RNGs, is as sensitive as other 
tests and runs much faster. Already with k = 3 extrac¬ 
tion ALPHABIT finds no significant patterns in ^ 2.3 
Tbits of data, organised as one file of 1 Tbit, two files of 
500 Gbits, one file of 80 Gbits, and two files of 64 Gbits. 
We also tested 300 sequences of lengths 1 Mbit, 0.2 Gbits, 
0.5 Gbits, 1.0 Gbit for /c = 1, 2, 3, and 4, respectively, and 
compare the failure rates to what is expected for an ideal 
random source. 

In conclusion, we have demonstrated a spontaneous- 
emission-driven random number generator suitable for 


extraction depth k 



FIG. 5. Measured two-point correlations (blue points) 
\4rx{k) \ for extracted bits x, computed on 300 Gbits, showing 
exponential approach to ideal behavior. Error bars show ±lcr 
statistical error in the correlation measurement. Horizontal 
bars show e^ax, the metrologically derived upper bound on 
predictability, for ordinary, (green) digitizer paranoid (or¬ 
ange) and fully paranoid (red) distrust levels and (left to 
right) Icr, 2(7, and 6cr confidence. (Lower left) Histogram 
of 4ra,(4) computed on 1000 runs of 1 Gb each, is normal by 
the Pearson test (p = 0.27). Curve shows ideal distribu¬ 
tion. 

closing the locality and freedom-of-choice loopholes in a 
test that also closes the detection loophole. By combining 
high-speed phase-diffusion RNG, real-time randomness 
extraction, and metrological guarantees, we have pro¬ 
duced extracted bits traceable to spontaneous-emission 
events less than 36 ns old and with excess predictabil¬ 
ity e < 10“^. Generation of high-quality random bits 
in narrow time windows enables definitive tests of quan¬ 
tum nonlocality and “device-independent” technologies 
guaranteed by the no-signaling principle. 
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Supplemental material for “Generation of fresh and pure random numbers for 
loophole-free Bell tests” 


DEVICE CONSTRUCTION 

The optoelectronic components (LD and PD) are 
commercial telecommunications devices designed for > 
10 Gbps direct-modulation data transmission at 1550 nm. 
The LD is temperature controlled with a Peltier element 
to ensure wavelength stability and incorporates an opti¬ 
cal isolator to prevent optical feedback. The PD incor¬ 
porates a low-noise trans-impedance amplifier with a lin¬ 
ear response. The interferometer is built of polarisation- 
maintaining single-mode fibre with fibre lengths cut to 
make the delay of the uMZI 5 ns, equal to the pulse repe¬ 
tition period. The logic elements (comparator, flip-flops 
and exclusive-OR) are designed for > 10 GHz operation 
with < 5ps jitter. A programmable clock distribution 
integrated circuit is used to adjust timings with 10 ps 
resolution to ensure the relative timing of sampling and 
logic operations. Printed circuit boards were designed, 
assembled and tested by the IGFO electronic workshop. 

SPONTANEOUS EMISSION DRIVEN PHASE 
DIFFUSION 

Laser phase diffusion (LPD) has been intensively stud¬ 
ied in LDs, where it is responsible for the free-running 
line-width [aO]. lpd in LDs is driven by spontaneous 
emission, spontaneous carrier recombination, Johnson 
noise in the current supply and technical noise sources 
such as environment-induced current fluctuations. Spon¬ 
taneous emission contributes a delta-correlated Langevin 
force [saisii, which when integrated makes a contribu¬ 
tion to 0 that is independent from one pulse to the next. 
In the 5 ns period considered here, this contribution is 
sufficiently large that the distribution of (j) wraps several 
times around the phase circle [191 EDI • 

To validate this model of phase diffusion, we perform 
heterodyne detection, beating the tested laser against 
a second “local oscillator” (LO) laser, both running at 
constant injection current. The beat note, tuned to 
^ 3 GHz by temperature adjustment of the LO, is de¬ 
tected with a fast photodiode (ThorLabs DET08GFG, 
5 GHz bandwidth), and digitized on a fast oscilloscope 
(Keysight/Agilent Infiniium MSO9404A) with band¬ 
width 4 GHz and sampling rate 20GSa/s. The observed 
signal is 

v{t) oc I^Lo(i) +£{t)? 

= \£Lo{t)\^ + £Lo{t)£*{t) + £lo{mt) + \£{t)\^ 

= + 25A{t) + A [cos£ttIie£{t) + sinf2i Im^(i)] 

■^0{5A^) + 0{5A\£\)^0{\£\^), (SI) 


where the last three terms are small. Here A(t) = 
A + dA(t) = \Si,o{t)\ describes the slowly-varying LO 
strength, U is the angular frequency of the LO in a 
frame rotating at the mean test laser frequency, and 
E{t) = (t)| exp[i(/)(t)] is the test laser field, also in the 

rotating frame. Linearising the model by dropping the 
last three terms, we extract JA(t),Ref(t) and ImS{t) 
by Rauch-Tung-Striebel smoothing, i.e., by bi-directional 
Kalman filtering |38l |39] . 

As seen in Fig. |S1[ the signals show direct evidence 
for phase-diffusion by spontaneous emission: at large or 
moderate amplitudes, the phase is stable for several cy¬ 
cles. It makes rapid changes, however, either increas¬ 
ing or decreasing the phase, when the amplitude \E\ be¬ 
comes small. In contrast to a laser above threshold, 
which diffuses in phase but returns to a finite equilib¬ 
rium amplitude, in a laser below threshold E executes a 
diffusive motion about the point E = 0. Because they 
contribute to the field with random phases, spontaneous 
emission events drive diffusion equally in the real and 
imaginary components of f, giving a phase diffusion co¬ 
efficient inversely proportional to the amplitude [36l [37] . 
This behavior is quantified in Fig. 4, which shows statis¬ 
tics acquired from 800 ns-long traces of signals of the kind 
shown in Fig. 

We quantify the phase diffusion using the Holevo vari¬ 
ance varH(0) = |(exp['i0])|“^ — 1, which is well-behaved 
for cyclic variables and approaches the ordinary variance 
var(0) = (0^) — (0)^ for small values. For the data shown 
in Fig. 4, we choose a time separation At = 50 ps, corre¬ 
sponding to the oscilloscope sampling period, and com¬ 
pute the phase diffusion as 

S4>rms = y^|(e»W*+'^‘)-‘^(*)l)|£||-2 - 1, (S2) 

where the angle brackets (•)|£:| indicate the average over 
all times t with a given \E\. The scaling J^rms oc \E\~'^ 
observed below threshold is a direct confirmation that 
spontaneous emission is responsible for the observed 
strong phase diffusion. Phase changes due to refrac¬ 
tive index variation would cause |-independent phase 
changes and fluctuating nonlinearities would give diffu¬ 
sion increasing with \E\. 

The 18 mA current used in Fig. [^is near the lasing 
threshold, resulting in multi-ns periods of slow diffusion. 
In contrast, when used in the RNG, the laser is taken far 
below threshold to produce much faster phase diffusion 
and maintained in this condition for 3 ns to achieve a full 
spontaneous emission driven phase randomization. 
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time (ns) 

FIG. SI. Direct observation of spontaneous emission driven phase diffusion in the DFB laser at a constant, threshold-region 
drive current of 18mA. Heterodyne signal v{t) (top, blue): Points show 20Gsa/s oscilloscope data, curve shows prediction of 
Kalman filter, from which amplitude A\8\ (middle, beige), phase 0 (bottom, maroon) and baseline (top, green) are obtained. 
Ruler (top, red) is a guide to make phase changes more visible. As expected for phase diffusion by spontaneous emission, rapid 
phase changes occur when the amplitude dips toward zero. 


UNPREDICTABILITY OF PHASE DIFFUSION 
IN NON-QUANTUM THEORIES 

Bell inequalities test local realistic hidden-variable the¬ 
ories (HVTs), and must be analyzed under the assump¬ 
tions of local realism, not those of quantum mechanics. 
Spontaneous emission and laser phase diffusion are ob¬ 
servable phenomena and unlike, say, entanglement, do 
not in themselves belong to any particular theory. More¬ 
over, it is an experimental observation, repeated on many 
kinds of lasers, that the phase of a laser executes a dif¬ 
fusive motion proportional to the spontaneous emission 
rate. Meanwhile, spontaneous emission, by Einstein’s 
thermodynamic A and B coefficient argument, is a nec¬ 
essary accompaniment of stimulated emission, and thus 
of laser amplification [40]. It would thus be difficult to 
exclude spontaneous emission, the archetype of a stochas¬ 
tic physical process, from the description of laser phase 
diffusion. 

To describe the role of randomness in a Bell test, we 
first note that any given experiment can only test lim¬ 
ited classes of HVTs. Fully deterministic HVTs, which 
Bell named “superdeterminism,” cannot be tested by any 
Bell test, because in superdeterminism it is impossible to 
make free choices for the settings [22] [41]. In contrast, 
stochastic HVTs, i.e., those in which some events are 
unpredictable even in principle, can be tested. Within 
this class, different HVTs will hold that some subset of: 
spontaneous emission, chaotic evolutions, thermal fluctu¬ 
ations, human decision-making, and any number of other 
arguably unpredictable processes, are stochastic. A Bell 
test can exclude some of these classes of stochastic HVTs. 

Directly observable and thus theory-independent con¬ 
tributors to laser phase diffusion include spontaneous 
emission, Johnson noise in the injection current, and car¬ 


rier density fluctuation due to spontaneous carrier recom¬ 
bination. Because the phase is cyclic, if any one of these 
is sufficient to randomize the phase, it remains a pure 
random variable even when the others are known in ad¬ 
vance. A test using these generators can thus exclude 
HVTs in which any of these processes is stochastic. In 
addition, a classical HVT in which the laser action is pro¬ 
duced by classical electrons moving inside a the laser gain 
material would almost certainly be chaotic, allowing the 
test of another class of stochastic HVTs. 


DETECTION MODEL 

When detected, pi{t) gives rise to an analog voltage 
signal v{t) = [h *p/](t) + vp-D{t), where h{t) is the im¬ 
pulse response of the detection system, * indicates con¬ 
volution, and i;pD is detector noise. Because the pho¬ 
toreceiver has a bandwidth much larger than the pulse 
repetition frequency, the signal mostly represents opti¬ 
cal energy received within the last tpd ^ 100 ps, and 
thus from the present pulse. Nevertheless, we need to 
take account of “hangover error,” i.e., delayed signal 
from previous pulses. We divide the impulse response 
as h{t) = hf{t) + hs{t), where hf{t) describes the short- 
time response of the detection system and is nonzero 
only for 0 < t < 5 ns, i.e. for one pulse repetition pe¬ 
riod, whereas hs{t) is nonzero only for t > 5ns and de¬ 
scribes the delayed response. We define vs = hf 
vp = /if vp = hs ^ Pi and the visibility V through 
V(i) = V cos (ps/vsvp = /if * (cos (t)yJPsPL)- We then have 

V = hi^pi ^h^^pi ^ vpD 

= Vs2V^JvsVp cos (/) + /is * P/ + Vpp 
= Vs Vp V(f) Vp -llpD. (S3) 


























Including the reference level noise the total un¬ 

trusted noise is = '^s + '^l + '^pd + '^h — '^ref¬ 
it is natural to ask whether all relevant noises are in¬ 
cluded in Pc- We note that, with the exception of Ps and 
pl, the individual noise contributions are each defined to 
be the total noise arising in some part of the conversion 
from optical to analog to digital. The noise in converting 
from optical to analog is ph + ppd • is defined as all 
the fluctuation that comes from prior pulses due to slow 
response of the detection system, whereas vd is defined 
as all other classical noise arising in the detection pro¬ 
cess. The noise in converting from analog to digital is 
Pref — ('^ref)- Again, this is defined to be all noise of that 
kind. 

Ps — (ps) and pl — (pl) describe fluctuations in the 
individual pulse strengths as they leave the laser. The 
fact that there are only two such sources comes from 
the fact that we are using an interferometer with two 
paths (short and long). This describes the topology of 
the interferometer, and is unambiguous. 


Distributions of analog and digital signals 

The digitized signal p = p^ -h Pc is the sum of p^ = 
Ap0 cos 0 , where (j) is trusted to be fully random and in¬ 
dependent, and Pc, which is untrusted, p^ is described by 
an arcsine distribution, with probability density function 
(PDF) 


P{v^ = x)= ^ i (S4) 

if |x| < Ap 0 and zero otherwise. The cumulative distri¬ 
bution function is 


r./ X r . X 2 1 X 

P[V6<x)= / dxP(x) = - arcsm W --h —r—, 

J—oo ^ y 2 ^ap0 

(S5) 

for \x\ < AV(f). We assume Pc is available to the distant 
particle and ask what distribution the particle would pre¬ 
dict for p, knowing Pc. This describes a conditional dis¬ 
tribution P(p = x|Pc) equal to P(P(/) = x — Pc), which 
is simply P(P(/, = x) shifted by Pc. When digitized as 
d = 6 >[p 0 + Pc], where 0 is the Heaviside function, the 
conditional distribution for d, i.e. the probability mass 
function, is 


P{d = 0) = P(p 0 + Pc < 0) = P(p 0 < -Pc) 


2 

= — arcsm 

TT 



Vc 

2 Ap 0 ’ 


(S 6 ) 


for |Pc| < Ap 0 . P{d = 1) is then 1 — P{d = 0) = 
n arcsin given in Eq. (3). 


RANDOMNESS EXTRACTION 


Consider two partially-random bits a = d[p^^^ -h Pc^^] 
and b = 0[v^^ + Pc^^] generated as above, where super¬ 
scripts and indicate distinct realizations of the 
variables. Because are not trusted to be in¬ 

dependent, the joint probability P(a = x, 6 = y) is not 
in general separable. Nevertheless, the conditional joint 
probability separates: P(a = x, 6 = ^|pc^\pc^^) = P(a = 
x\v^^)P{h = ^|Pc^^), because the conditioned a and h are 
a function only of the independent p^^^ and p^^^, respec¬ 
tively. This allows us to use the properties of independent 
random variables in computing predictability bounds. 

For a partially-random bit d, the predictability is 
V{d) = max[P(d = 0),P(d = 1)]. An ideal random bit 
has predictability 1 / 2 , and writing P(d) = ^(1 + e^^) we 
find the error ea = 2 P(d) — 1 . Considering two partially- 
random bits a and 6 , with predictabilities P(a),P( 6 ), re¬ 
spectively, P(a 06 ), the predictability of a 06 is the larger 
of 

P(a 0 6 = 0) = P(a = 0)P(6 = 0) 0 P(a = 1)P(6 = 1) 
and 

P(a 0 6 = 1) = P(a = 0)P(6 = 1) 0 P(a = 1)P(6 = 0), 
from which we find 


p(a 0 6 )= P(a)P( 6 ) 0 [1 - P(a)] [1 - P( 6 )] (S7) 

or 2P(a 0 6 ) - 1 = [2P(a) - 1][2P(6) - 1], so that 

^a06 — 

Moreover, if < ea,max and < e^^max i-e. if the errors 
are bounded from above, then 


^a06 ^ ^a,max^6,] 


(S9) 


because 6^06 is monotonically increasing in both and 
65 . When computing XiJ^k = 0 • • • where 

^d- < ,max, repeated application of Eq. (S9) gives 




(SIO) 


This shows an exponential approach to ideal randomness. 
Note that which is due to events in the past light- 
cone of the detection, as shown in Fig. 1, contributes no 
randomness and = 1 . 


NOISE MEASUREMENTS 

Statistics are measured with an AC-coupled oscillo¬ 
scope (Agilent Infinitum MSO9404A) with 4 GHz input 
bandwidth and 8 bit resolution. Statistics are acquired 
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FIG. S2. Measurement of “hangover error.” Upper image shows persistence mode oscilloscope trace of trains of 9 optical pulses 
giving rise to 8 strongly interfering pulses followed by one pulse without interference, shown in higher resolution in the lower 
image. Pulse repetition period is 5 ns. Teal histograms on left vertical axis show data sampled in the region defined by the 
white cursors. “Hangover,” i.e., remaining variation from previous pulses, is visible at the start of the lower trace, and decreases 
approaching the sampled point. 


as histograms of sampled voltages within a 50 ps win¬ 


dow, as shown in Fig. 2 b) & c). All signals in Table S-I 


except Vo and v^ei + vq were measured at the photodi¬ 
ode output. To measure vi, + 'T’pd + vo oi* '^s + '^pd + '^o 
we block the short or long path of the interferometer, 
respectively. To measure hangover errors, we use a fast 
analog switch (Mini-circuits ZASWA-2-50DR-b) to peri¬ 
odically block the train of current pulses to the LD, see 
Section [] Immediately following the turn-off, a single 
long-path pulse arrives to the photodiode with no cor¬ 
responding short-path pulse, thus producing a voltage 
+ '^PD + '^o- The full interferometer produces 
'^0 + '^s + '^L + '^PD + + 'No¬ 


table S-I. Measured noise statistics. All voltages in mV. 
uo, Vq and Vq indicate the oscilloscope noise at gains of 
50mV/division, lOOmV/division and 200 mV/division, re¬ 
spectively. I’L+UH+r’pD+r’o is measured using an interrupted 
pulse train, as in Section [] Uref + r’o is measured using the x-y 
method of Sec. [] is determined from the fit of Fig. 3. 


measured variables 

r.m.s. 

dev. 

derived 

variables 

mean 

r.m.s. 

dev. 

Vo 

1.7 




UPD + Vo 

1.9 

UPD 


0.8 

r’s + 'CpD + Vo 

2.2 

vs 

251 

1.1 

r’L + 'CpD + Vo 

2.3 

Vl 

251 

1.3 

r’L + r’H + r^pD + vo 

4.4 

Vu 


3.8 


3.4 




r^ref T Vo 

8.4 

Vrei 


7.7 

'^O 

7 




Vcf, Vs Vi^ UPD + 

vn + v'o 

354 

Au^ 

483 



The reference voltage Pref is studied in two ways. 1) We 
measure the width of the comparator transition thresh¬ 
old, by correlating the digital output to the random ana¬ 
log input (see subsection [|. 2 ) direct measurement of 
with the oscilloscope. These two methods give consistent 
results for In contrast to all technical noises 

contributing to v appear normally distributed with his¬ 
tograms obeying the “68-95-99.7” rule. 

We simulated Eq. ( 2 ) by generating normally dis¬ 
tributed random numbers with means and r.m.s. de¬ 
viations given by the measurements shown in Table [SM 
The phase was simulated to be fully randomised. The 
resulting distribution was fitted to an arcsine distribu¬ 
tion, as shown in Eq. (S4), finding ( 2 Ap 0 ) = 966 mV. 
The fit is shown in Fig. 3. In calculating the 6 cr bound 
on 7 ^, we adjust this value downward by a multiplicative 
factor — 6 cr^g/(ps)\/l ~ 6 cr^L/(pL) ~ 0.971 to con¬ 
servatively account for fluctuations in Ap^. 

We find (Pc), the mean of the combined 
noises, from {vc) = 2 Ap 0 [(sin^(Pi 7 r/ 2 )) — 1 / 2 ] « 
2 Ap 0 [sin^((Pi) 7 r/ 2 ) — 1 / 2 ] = 3.0mV, using the measured 
(Pi) = 0.50035. The approximation of (sin^(Pi 7 r/ 2 )) is 
justified in light of Eq. (3) and the observed \vc\ <C Ap^. 


Measurement of hangover errors 

To measure the hangover errors, we periodically inter¬ 
rupt the modulation of the LD using an RF switch (Mini- 
Circuits ZASWA-2-50DR-f) at 10 MHz. This generates 
a train of optical pulses at the output of the laser. Due 
to the relative path difference in the interferometer, three 
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Detuning [ps] Input voltage [mV] 

FIG. S3. (Left) Probability of getting an output zero or one for each input analog voltage V 2 - As observed, there is a small 
region near the threshold region in which input values can give zero or one with certain probabilities. The transition probability 
from 0 ^ 1 (1 ^ 0) is in excellent agreement with the integral of a Gaussian with < 7.7mV. (Right) Measured noise 
as a function of the detuning between the oscilloscope sampling time and the flip-flop sampling time. We emphasise this 
measurement is conservative, as the measured error is necessarily larger than the real error. 


different types of pulses emerge: (i) the first output pulse, 
which contains only a short-path contribution and expe¬ 
riences no interference, (ii) the intermediate pulses, which 
contain both short and long-path contributions and show 
interference and (iii) the last pulse, which contains only 
a long-path contribution and thus shows no interference. 
This last pulse also contains any delayed response, i.e. 
“hangover,” from previous pulses. By measuring the sta¬ 
tistical behavior of this last pulse, and comparing against 
the long-path signal obtained by blocking the short-path, 
we can recover the contribution from hangover errors. 
This is illustrated in Fig. [S^ which shows a train of nine 
optical pulses. For the data reported in Table S-I trains 
of ten pulses were used. 


Noise in the reference level: Input-Output analysis 


(Mini-Circuits ZFRSC-183-S+) after the photodetector 
to get two copies of the output analog random ampli¬ 
tude vi^ 2 ‘ We send vi to the comparator input and V 2 
to the oscilloscope, which also records the output of the 
first flip-flop, i.e., the comparator output latched exactly 
at the same point the oscilloscope is sampling. In order 
to match the sampling points of the oscilloscope and the 
flip-flop, we sweep the sampling point of the oscilloscope 
in steps of 10 ps until we find the best agreement, see 
Fig.(left). Note that having the oscilloscope sampling 
at exactly the same point as the flip-flop is critical for this 
measurement. The analysis shows a small but finite over¬ 
lap between range of input values giving low versus high 
output values near the threshold voltage. Computing the 
frequency of high and low outputs for each input value 
V 2 ^ we obtain the conversion probabilities P{d = x\v 2 ) 
for X G {0, 1 }. 


In addition to a direct measurement of the com¬ 
parator reference voltage, we also measured the input- 
output relation, which quantifies the performance of the 
1 -bit analog-to-digital conversion (ADC). Note that while 
an ideal comparator converts each analog input into an 
unambiguous digital output, a real comparator has noise 
and therefore the conversion of input values near the ref¬ 
erence voltage might contain some uncertainty. In order 
to quantify this “transition voltage” range, it is not suf¬ 
ficient to measure the reference noise, as any extra effect 
occurring inside the comparator itself or lack of knowl¬ 
edge of the performance of the device would be neglected. 
We emphasise this measurement makes no assumptions 
at all about the circuit, making the measurement out¬ 
come ultimately transparent. As shown in Fig. |S4[ the 
measurement setup is as follows: we use a 3 dB splitter 


comparator 



FIG. S4. Schematic for the characterization of the comparator 
chip. The signal from the photodetector (PD) is split in two 
by means of a 3-dB splitter. One of the signals is sent to the 
comparator and the other to the scope, and delayed using the 
skew function of the scope. The sampling point of the com¬ 
parator can be tuned with 10 ps resolution. By capturing the 
digital signal output of the comparator and the analog signal 
recorded by the scope, we can measure the performance of the 
comparator, e.g. the probability of the output conditioned on 
the input. 
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The measurement suffers from some limitations. In an 
ideal scenario, we would need (i) the two outputs of the 
3-dB splitter to be identical and (ii) the sampling point 
of the oscilloscope and flip-flop too. In practice, unfor¬ 
tunately, (i) the two outputs of the 3-dB splitter are not 
identical but their difference follows a Gaussian distribu¬ 
tion with 0 mean and 1.32 mV rms deviation, and (ii) 
the timing precision is limited to 10 ps. Note that the 
presence of both limitations are conservative from the 
measurement point of view, i.e., the real error will al¬ 
ways be smaller than the measured error. The narrowest 
observed transition is depicted in Fig. (right), and 
shows an r.m.s. width of 8.4 mV. Considering that the 
oscilloscope noise is 3.4 mV rms, we can place an upper 
limit: < 7.7 mV. 


UPPER AND LOWER BOUNDS ON THE 
FRESHNESS TIME 


As illustrated in Fig. 1 of the main article, the window 
for randomness generation is bracketed on the early side 
by the requirement for space-like separation from the dis¬ 
tant detection, and on the late side by the requirement 
for space-like separation from the pair generation. Ensur¬ 
ing the random events fall in this window requires both 
upper and lower bounds on the freshness time. We mea¬ 
sure timing of relevant events using a differential probe 
and a 20 GSa/s real time oscilloscope (Agilent Infinitum 
MSO9404A). As shown in Fig. S5, we measure three de¬ 
lays in the circuit: (i) ti\ from the modulation of the 
laser, measured directly on the pins of the laser, to the 
output of the photodetector, (ii) ^ 2 : from the output of 
the photodetector to the input of the XOR gate, and (iii) 
ts: from the input of the XOR gate to the CML output 
connector. We split in three intervals for traceability of 
the signal while travelling through the electronics. 

All delays are quantified by capturing traces and us¬ 
ing cursors to identify the zero-crossing times of relevant 
edges. As shown in Fig. |S5[ for each transition we 
identify a best guess limited by the uncertainty 

of the interpolation between 50 ps samples. We find 
^(best) ^ ^ g2 ns, = 1.16, and = 1-55 ns. 

Measuring intervals on the oscilloscope can give a sys¬ 
tematic error, which we now bound. In light of the 
^ 100 — 150 ps 10%-90% rise and fall times of the tran¬ 
sitions, it is extremely improbable that we misjudge the 
location of the edge by 100 ps or more, as it would mean 
placing the best guess outside of the transition region. 
As illustrated in Fig. [S6l we calculate upper and lower 
bounds for the transition times as IQO ps 

and — 100 ps, respectively. Combining the 

three measured intervals we find = 

10.87 ns and — 10-21 ns. Fig. 

shows the sequence of measurements performed. 
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The jitter of the signal plus the jitter of the oscilloscope 
is quantified by accumulating 10 ^ traces using the per¬ 
sistence mode of the oscilloscope. Measuring the rising 
edge of the signal at the photodiode output (as in Fig. 
S 2 , e.g.), we observe that all of the traces fall within a 125 
ps temporal window; there is no recorded value outside of 
this window. Making the hypothesis that events outside 
of this window occur with probability at least 1.4 x 10“^, 
we expect > 14 events on average outside of this win¬ 
dow. A Poisson distribution with this mean predicts our 
observed zero events with probability 8 x 10“^. We can 
thus reject the hypothesis and assign a p < 1.4 x 10“^ 
confidence to the 125 ps window for the measured zero- 
crossings. We note that this does not count the contri¬ 
bution of the oscilloscope to the jitter and is thus con¬ 
servative. The freshness time combines intervals from 
three cascaded measurements. Adding three such win¬ 
dows, the conservatively estimated window for the full 
process is 3 x 125 = 375 ps. Half of this, 187.5 ps, can 
be assigned to the upper limit, and half to the lower. To 
have a round number, we define the jitter bound to be 
Tjitt = 200 ps. 

The lower and upper bounds for the freshness time of 
a single bit, including statistical and systematic errors, 
conservatively estimated, are then 


- Tjitt <rf< Tjitt 

10.01 ns < Tf < 11.07 ns 


(511) 

(5 12 ) 


We also observe that the rms width of the jitter is 
CTjitt < 40 ps. If the jitter can be considered normally 
distributed, rjitt is then at least 5crjitt, and could be made 
considerably stronger, e.g. at least lOcrjitt, with only a 
200 ps broadening of the bounds given above. 

The operating frequency of the quantum random num¬ 
ber generator is nominally 200 MHz, which corresponds 
to a cycle time of 5 ns. The clock of the RNG can be de- 



FIG. S5. (color online) Schematic of the random number 
generator with timing information as directly measured by a 
20 GSa/s real time oscilloscope. ti describes the time from 
rising edge of the current pulse until rising edge of the PIN 
PD output pulse, t 2 describes the time from the PIN PD pulse 
to the input of the XOR gate, and ts the time from the input 
of the XOR gate to the output SMA port. 
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log Devices AD9522/PCBZ), in either case introducing a 
timing uncertainty that is nominally < 1 ps and negligi¬ 
ble on the scale of the other uncertainties. The freshness 
time for k events is therefore given by 

Tf = Tf + 5 X (/c — 1) ns. (S13) 


FIG. S6. (color online) For a given captured trace, the best- 
guess estimate for the zero-crossing time is found by interpo¬ 
lation between the 50 ps samples of the 20 Gsps oscilloscope, 
with systematic uncertainty (orange circles). To obtain the 
upper bound (purple) and lower bound (orange) for the zero¬ 
crossing time, we add or subtract the half-width of the transi¬ 
tion. Statistical uncertainty is accounted separately from the 
statistics of 10^ traces collected in the oscilloscope’s persis¬ 
tence mode. 


STATISTICAL TESTING 

A fast digitizer (Acquiris U1084A) is used to acquire 
the RNG output for statistical testing. Because of mem¬ 
ory limitations, data is acquired in runs of ~ 8 Mb each 
and concatenated. 


rived from an external reference via a phase-locked loop, 
or internally generated from a quartz oscillator (Ana- 
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FIG. S7. (color online) Details of the sequence of measure¬ 
ments to obtain the freshness time. We start by measuring 
the modulation pulse directly at the laser diode pins (1). The 
LD generates an optical pulse some time after the modulation 
pulse is applied (2). Then, the signal is photodetected and 
measured (3). The difference between (1) and (3) gives ti. 
Then, the electrical pulse is digitised by a fast comparator 
and latched by a first flip-flop (4), and then propagates until 
the input of an XOR gate (5). At the input of the XOR gate 
we can tap the signal and measure the arrival time. The dif¬ 
ference between (3) and (5) gives ^ 2 - Finally, the signal goes 
into the randomness extraction circuitry (see main text for 
more details), and propagates to the output, where we mea¬ 
sure the arrival time again (6). The difference between (5) 
and (6) gives ts. 


Sample autocorrelation 


The two-point autocorrelation is Tx{k) = (xiXi-^k) — 
(x)^, where k is the correlation distance. To obtain ex¬ 
perimental autocorrelations from a sample of N bits as 
in Fig. 5,we compute the unbiased estimator for Tx{k) 


t.{k) 


1 


N-k 


N-k 

i=0 


1 

N 


i=0 


(S14) 


For a perfect coin and large A, the estimator has rms 
statistical uncertainty crp = l/4\/]V. 

Considering the output of the RE, with Xi = 0d^, 

where di are raw bits, we note that x can be described as 
a symmetric two-state machine that changes state when¬ 
ever d = 1. This symmetry guarantees the long-time 
average {x) = 1/2, except if d is deterministic. 

We estimate Tx{k) when d has bounded predictability, 
i.e. max[P(di = 0),P{di = 1)] < |(l + eniax) for all i. We 
note that XiXi-^k is only nonzero for Xi = Xi^k = 1, so we 
can evaluate {xiXi-^k) as the probability P{xi = 1) = ^ 
times the conditional probability P{xi-^k = — !)• 

This latter is the probability of an even number of d = 1 
raw bits between i and i P k. Subject to the bound, 
this is maximized when P{di = 0) = ^(1 -h Cmax) for all 
i. Counting the possible ways to have an even number, 
where n is the number of bits with d = 1, we find 

r^{k) = (xiXi+k) - (x)^ 

1 / lc\ 1 

“2^ E (2,,^) ^"“4 

n=0 ^ ^ 

= bLx- (S15) 


Statistical test batteries 

Several statistical batteries are used to test the quality 
of the output, including the TestUOl Alphabit battery 
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[35] . the NIST SP800-22 battery [34], and the Dieharder 
battery [33]. The results are consistent with ideal ran¬ 
domness for /c = 3 and above. 

Due to the high output rate of the RNG, testing was 
limited by computation speed for the various tests. In 
this regard Alphabit has a significant advantage, as it was 
designed for testing physical RNGs, without the more 
computationally-intensive tests used for pseudo random 
number generators. For example, testing a 1.5 Gb se¬ 
quence with the NIST battery takes more than 3 hours on 
a desktop computer whereas the Alphabit battery takes 
one minute. 


Dieharder tests 

We ran the dieharder test with default settings. Re¬ 
sults are shown in Table IS-III 


Test UOl Alphabit battery 


We use the Alphabit battery following two testing 
strategies: (i) test many different sequences of a rela¬ 
tively small size, e.g. 300 files of 1 Gb each, and (ii) 
testing very long sequences, e.g. one file containing 1 
Tb. Using (i), we can quantify how often the generator 
fails the Alphabit battery. This is important because an 
ideal random number generator should fail with around 
2% probability. With (ii) we can test for weaker cor- 
relations/anomalies, below the statistical uncertainty of 
strategy (i). 


Results for strategy (i) are depicted in Fig. (SIO). We 
tested 1 Mb for k=l, 120 Mb for k=2, 500 Mb for k=3, 
and 1 Gb for k=4. In each case we test 300 sequences. 
For strategy (ii) we tested a single 1 Tb file, two 500 
Gb files, one 80 Gb file, and two 64 Gbfile for /c = 3 
and all tests were passed. We followed the same criterion 
for evaluating the results as in |42| in which regularities 
in commercial RNG systems were found for 64 Gb and 
above. 


NIST SP800-22 

As per NIST recommendations [34|, we use m = 1500 
sequences of 1 Mb each to assess the random numbers 
generated by the device. The tested sequences pass both 
the proportion and uniformity of the p-values assess¬ 
ments. See Fig. 
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TABLE S-IL Summary of results for the entire Dieharder battery for k=3. In column n tuple, the notation 1.. .x indicates 
that the test was repeated with the n tuple setting covering this range. As shown, the diehard parking lot test showed a weak 
value, i.e., an inconclusive result, in the initial run. For an ideal source, it is expected that ~ 1 weak value will appear in any 
given full test run of the suite. As recommended, we re-run the weak test with the option -Y, which increases p samples until 
a clear result (passed or failed) emerges. The test was passed. 


test name 

n tuple 

t samples 

p samples 

p- value 

Assessment 

diehard birthdays 

0 

100 

100 

0.86914871 

PASSED 

diehard operm5 

0 

1000000 

100 

0.62710352 

PASSED 

diehard rank 32x32 

0 

40000 

100 

0.49138373 

PASSED 

diehard rank 6x8 

0 

100000 

100 

0.46907910 

PASSED 

diehard bitstream 

0 

2097152 

100 

0.94865200 

PASSED 

diehard opso 

0 

2097152 

100 

0.41217400 

PASSED 

diehard oqso 

0 

2097152 

100 

0.49075022 

PASSED 

diehard dna 

0 

2097152 

100 

0.78245172 

PASSED 

diehard count Isstr 

0 

256000 

100 

0.59545874 

PASSED 

diehard count Isbyt 

0 

256000 

100 

0.44152512 

PASSED 

diehard parking lot 

0 

12000 

100 

0.99601277 

WEAK 

diehard 2dsphere 

2 

8000 

100 

0.93564067 

PASSED 

diehard 3dsphere 

3 

4000 

100 

0.94103902 

PASSED 

diehard squeeze 

0 

100000 

100 

0.58677274 

PASSED 

diehard sums 

0 

100 

100 

0.76102130 

PASSED 

diehard runs 

0 

100000 

100 

0.11968119 

PASSED 

diehard runs 

0 

100000 

100 

0.51728489 

PASSED 

diehard craps 

0 

200000 

100 

0.86247445 

PASSED 

diehard craps 

0 

200000 

100 

0.97041678 

PASSED 

marsaglia tsang gcd 

0 

10000000 

100 

0.68088920 

PASSED 

marsaglia tsang gcd 

0 

10000000 

100 

0.20851577 

PASSED 

sts monobit 

1 

100000 

100 

0.15319982 

PASSED 

sts runs 

2 

100000 

100 

0.80047009 

PASSED 

sts serial 

1...16 

100000 

100 

0.11969309 - 0.98698338 

PASSED 

rgb bitdist 

1...12 

100000 

100 

0.07588499 - 0.96001991 

PASSED 

rgb minimum distance 

2 

10000 

1000 

0.19433266 

PASSED 

rgb minimum distance 

3 

10000 

1000 

0.45871020 

PASSED 

rgb minimum distance 

4 

10000 

1000 

0.53968425 

PASSED 

rgb minimum distance 

5 

10000 

1000 

0.82922021 

PASSED 

rgb permutations 

2 

100000 

100 

0.59213936 

PASSED 

rgb permutations 

3 

100000 

100 

0.77283570 

PASSED 

rgb permutations 

4 

100000 

100 

0.98499840 

PASSED 

rgb permutations 

5 

100000 

100 

0.47842741 

PASSED 

rgb lagged sum 

o 

CO 

to 

1000000 

100 

0.11439306 - 0.99357917 

PASSED 

rgb kstest test 

0 

10000 

1000 

0.81377150 

PASSED 

dab bytedistrib 

0 

51200000 

1 

0.45890415 

PASSED 

dab dct 

256 

50000 

1 

0.80469155 

PASSED 

dab hlltree 

32 

15000000 

1 

0.22779072 

PASSED 

dab hlltree 

32 

15000000 

1 

0.61178536 

PASSED 

dab hlltree2 

0 

5000000 

1 

0.18837842 

PASSED 

dab hlltree2 

1 

5000000 

1 

0.49022984 

PASSED 

dab monobit2 

12 

65000000 

1 

0.43688754 

PASSED 
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FIG. S8. Summary of results for the NIST SP800-22 battery. The top figure depicts the results for the proportion test, i.e. 
evaluating how many times each test passes or fails (note that even a perfect random number generated is supposed to fail 
some tests from time to time). Dot-dash lines indicate limits of acceptable behavior as recommended by NIST SP800-22. The 
bottom picture represents the uniformity of the p-values assessment, which mainly quantifies how the outcomes of each statistic 
(p-values) are distributed along the (0,1) range. Both quantities satisfy the statistics for a perfect random number generator. 




FIG. S9. Statistical tests for /c = 1. (Left) represents the results for each of the 17 tests (horizontal axis) in the Alphabit 
battery for 300 iterations (vertical axis). A dark blue square represents a weak value is observed for that particular iteration and 
test. For each test, a p-value p is computed and its deviation from zero or one A(p) = min{l —p,p} is measured. If A(p) > 10“^ 
the test is considered to pass that statistic. In contrast, a test is considered inconclusive or weak when its deviation is 
10“^ > A(p) > 10“®, failed when 10“® > A(p) > 10“^^, “eps,” which implies catastrophic failure, when 10“^^ > A(p) > 10“^°°, 
and “eps2” when A(p) < 10“^°°. (Right) shows the frequency of obtaining weak, failed, eps, and eps2 p-values for each of 
the 17 tests of the alphabit battery. As shown, for k=l the alphabit battery is able to hnd statistically significant anomalies, 
indicating the need for randomness extraction. 
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FIG. SIO. (Rows 1 and 2 correspond to the statistical tests for /c = 2 and /c = 3, respectively. (Left column pictures) represent 
the results for each of the 17 tests (horizontal axis) in the Alphabit battery for 300 iterations (vertical axis). A dark blue 
square represents a weak value is observed for that particular iteration and test. For each test, a p-value p is computed and its 
deviation from zero or one A(p) = min{l — p,p} is measured. If A(p) > 10“^ the test is considered to pass that statistic. In 
contrast, a test is considered inconclusive or weak when its deviation is 10’ ^ > A(p) > 10 failed when 10 ® > A(p) >10 
“eps,” which implies catastrophic failure, when 10’ > A(p) > 10 and “eps2” when A(p) < 10 (Right column 

pictures) show the frequency of obtaining weak, failed, eps, and eps2 p-values for each of the 17 tests of the alphabit battery. 
For k=2, the results are statistically acceptable, but appear borderline. For k=3,4 (the k=4 case is not shown), the failure rate 
is consistent with an ideal randomness source. 



























